CVE-2026-27688Medium· 5.0▾ SunlitDue to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
0.2% → 0.3%
Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidentiality of the information stored. However, the integrity and availability of the system are not affected.
netweaver_application_server_abap = 700netweaver_application_server_abap = 701netweaver_application_server_abap = 702netweaver_application_server_abap = 730netweaver_application_server_abap = 731netweaver_application_server_abap = 740netweaver_application_server_abap = 750netweaver_application_server_abap = 751netweaver_application_server_abap = 752netweaver_application_server_abap = 753netweaver_application_server_abap = 754netweaver_application_server_abap = 755netweaver_application_server_abap = 756netweaver_application_server_abap = 757netweaver_application_server_abap = 758netweaver_application_server_abap = 816Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-58237Medium· 5.9WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality
CVE-2024-41730Critical· 9.8Missing Authentication check in SAP BusinessObjects Business Intelligence Platform
CVE-2026-66778Medium· 5.3SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components
CVE-2026-66777Medium· 5.9SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations
CVE-2026-66776Medium· 5.9SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions
CVE-2026-66775Medium· 4.3SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default